Could be that the passwords were hashed, but something logged a password, or there was leakage somewhere during the login process. All it takes is one debug lo

Could be that the passwords were hashed, but something logged a password, or there was leakage somewhere during the login process. All it takes is one debug log statement to leak through from development and you can be logging plain-text passwords on every login.